The most common irreversible mistake in Part X is committing something that should never enter history: API keys, customer data, local databases, or thousands of dependency files. A .gitignore file tells Git which paths to never track. Create it before your first commit — removing a leaked secret later means rotating it everywhere, not just deleting a line.

The starter (copy, then adjust)

# Secrets and local config — never commit
.env
.env.local
.env.*.local
*.pem
*.key

# Local data — belongs in the database or storage, not history
*.sqlite
*.db
/data/local/

# Dependencies — reinstallable, not reviewable
node_modules/
venv/
__pycache__/

# Build output — generated, not source
dist/
build/
.next/

# OS and editor noise
.DS_Store
Thumbs.db
.vscode/
.idea/

Why each group earns its line: secrets because a committed key must be revoked everywhere it was ever pushed; local data because real rows belong in the database with access rules, not in a cloneable folder; dependencies and build output because they bloat diffs and hide the real change; OS/editor files because they create churn with zero meaning.

Adjust per stack (Python vs Node vs other), but never remove the secrets block. If your project needs a documented variable name, put the *name* in .env.example (safe to commit) and the *value* only in .env plus the deployment platform's environment settings.

Verify before you trust it

1. Create the file at the repo root as .gitignore. 2. Run git status. Confirm .env, local DB files, node_modules/, and build folders show as ignored (or absent), and only intended source appears as untracked or modified. 3. Deliberately test the dangerous one: git check-ignore -v .env should print the matching rule. If it prints nothing, the file is not protected — fix the pattern before committing anything.

Finish line: .gitignore committed, git status clean of secrets, .env.example holding names only.

Common failure mode: adding .gitignore *after* the secret was committed. Git keeps tracking files it already knows. Recovery: rotate the exposed credential immediately, remove the file from history with help (or accept it stays in old commits), then enforce the ignore going forward. Prevention beats cleanup every time.